Security researchers successfully manipulated Microsoft Copilot Personal into disclosing its own vulnerabilities by embedding malicious prompts in URLs, eventually tricking the AI assistant into sending sensitive data to external servers and poisoning its persistent memory.
Matthew Elliott embedded invisible prompt injections in 3-point white text on white background in court filings, attempting to secretly influence a potential AI review system to rule in his favor. Judge Walter Spader Jr. revoked Elliott's electronic filing privileges, comparing the tactic to jury tampering.
Security firm PromptArmor has demonstrated that Atlassian's Rovo AI assistant can be hijacked through hidden instructions in uploaded PDFs or malicious links to silently exfiltrate sensitive data from Jira, Confluence, and third-party integrations to attacker-controlled servers without user approval or audit trails.
